Summary
It was discovered that setuptools was vulnerable to remote code
execution. An attacker could possibly use this issue to execute arbitrary
code.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | setuptools | 45.2.0-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | setuptools | 59.6.0-1.2ubuntu0.22.04.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | setuptools | 68.1.2-2ubuntu1.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python-setuptools | 3.3-1ubuntu2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-setuptools | 20.7.0-1ubuntu0.1~esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-setuptools | 39.0.1-2ubuntu0.1+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-setuptools | 44.0.0-2ubuntu0.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python-setuptools | 44.1.1-1.2ubuntu0.22.04.1+esm1 |
Vulnerabilities 1
-
High 8.8
Remote Code Execution in pypa/setuptools
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index …
References
-
report
https://ubuntu.com/security/CVE-2024-6345